<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello, we are trying to connect to a Strongswan 5.1 box with an
older Sarian GPRS router (MR4110).<br>
One thing for the record, this router ships without encryption, only
authentication. <br>
But we are stuck elsewhere: we use aggressive mode with PSK for
testing, with the following config :<br>
<br>
conn test<br>
keyexchange=ikev1<br>
authby=secret<br>
left=w.x.y.z<br>
leftsubnet=10.100.100.0/24<br>
right=%any<br>
rightsubnet=172.16.45.0/24<br>
rightid=@test_id<br>
auto=add<br>
ike=aes256-sha1-modp1024<br>
esp=null-sha1<br>
<br>
<br>
<br>
and we see the following:<br>
(some lines omitted)<br>
<br>
May 26 12:06:47 router-cmsdmz charon: 02[NET] received packet: from
a.b.c.d[500] to w.x.y.z[500]<br>
May 26 12:06:47 router-cmsdmz charon: 13[ENC] parsed AGGRESSIVE
request 0 [ SA KE No ID V V V V V ]<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] looking for an ike
config for w.x.y.z...a.b.c.d<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] ike config match: 1052
(w.x.y.z a.b.c.d IKEv1)<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] candidate:
w.x.y.z...%any, prio 1052<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] found matching ike
config: w.x.y.z...%any with prio 1052<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] received DPD vendor ID<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] received
draft-ietf-ipsec-nat-t-ike-03 vendor ID<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] received
draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] received NAT-T (RFC
3947) vendor ID<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] received Cisco Unity
vendor ID<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] a.b.c.d is initiating
a Aggressive Mode IKE_SA<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] selecting proposal:<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] proposal matches<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] received proposals:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] selected proposal:
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
May 26 12:06:47 router-cmsdmz charon: 13[CFG] looking for pre-shared
key peer configs matching w.x.y.z...a.b.c.d[test_id]<br>
<b>May 26 12:06:47 router-cmsdmz charon: 13[CFG] peer config match
local: 1 (ID_ANY)</b><b><br>
</b><b>May 26 12:06:47 router-cmsdmz charon: 13[CFG] peer config
match remote: 0 (ID_KEY_ID -> (...))</b><br>
<b>May 26 12:06:47 router-cmsdmz charon: 13[CFG] ike config match:
1052 (w.x.y.z a.b.c.d IKEv1)</b><br>
<b>May 26 12:06:47 router-cmsdmz charon: 13[IKE] no peer config
found</b><br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] queueing INFORMATIONAL
task<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] activating new tasks<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] activating
INFORMATIONAL task<br>
May 26 12:06:47 router-cmsdmz charon: 13[ENC] generating
INFORMATIONAL_V1 request 2881963356 [ N(AUTH_FAILED) ]<br>
May 26 12:06:47 router-cmsdmz charon: 13[IKE] IKE_SA (unnamed)[2]
state change: CONNECTING => DESTROYING<br>
<br>
So the peer sends its ID and charon finds the matching config
section but then decides it does not actually match ?<br>
What is wrong here? Sadly I cannot get the client to send a <i><b>remote
ID</b></i>, might that be the problem in a NAT-T situation?<br>
<br>
<br>
<div class="moz-signature">Best regards,<br>
Jakob Curdes<br>
</div>
</body>
</html>